Analysis

  • max time kernel
    72s
  • max time network
    76s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/11/2023, 16:26

General

  • Target

    https://www.thestreameast.to/ccce-nhl-streams

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.thestreameast.to/ccce-nhl-streams
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d8c09758,0x7ff8d8c09768,0x7ff8d8c09778
      2⤵
        PID:1444
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:8
        2⤵
          PID:4572
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:2
          2⤵
            PID:1460
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:8
            2⤵
              PID:636
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:1
              2⤵
                PID:1836
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:1
                2⤵
                  PID:4636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:8
                  2⤵
                    PID:164
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:8
                    2⤵
                      PID:1664
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3556 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:1
                      2⤵
                        PID:1260
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1484 --field-trial-handle=1772,i,5748224096249029168,14044684384124783144,131072 /prefetch:1
                        2⤵
                          PID:1752
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4040

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          432B

                          MD5

                          0bcf49b814a7db3e09146b533d1cdd50

                          SHA1

                          95b4e0d5872bb198e9efa2939edda12ccd35d899

                          SHA256

                          11fa3d50c512fdbd56ade511ddb45f8c98928af04731645c79fb53e09c7a33f2

                          SHA512

                          99013b02e69fc6a65479c5bc3589e0df3053d4b58755036a0438e648fed9fde3c31be6c46ccdb4b2b5aa0c9770d679b5e13ff5f59a22fbcec2a02abae6656074

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          8ede0b7010bc78fe9abc16f4f434bc26

                          SHA1

                          09dc6cd4ed443d52cb225e0776b0aaaf90489d1d

                          SHA256

                          f938e250844c3f14caf1ef89f9dda00bab4dc49e1be146df56d0ca5f1e8cc989

                          SHA512

                          3f18b681c7681ff5633450f7e648070ff6b2bcf3c1e5d3676e44a67affffb4065cc81bb33d15a0337ac25fe9c9c2a1b009b2e4da458945437c279202f4bbe802

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          234ae5258e03b94f1358423e61ecb570

                          SHA1

                          f8255fe8d09dc559557cfc5ebf140a9814e305f7

                          SHA256

                          676555a2252220f10901badc8ef7db7a4a8601f071be6fd58f3ab37264393848

                          SHA512

                          d54e259ec8d8bdf637612c0e5a2341b4ef42e9ec97150abb826fdb68d51e892830521501ed3d66215c72c7c9175a75009227e549caddcb31c1eedccf11144251

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          cde773a9d2977ba43951225e3af196df

                          SHA1

                          3b3a4a52a2b43a8aea4b1acae5c20dce319d924c

                          SHA256

                          e2180cc311a3069996581ca222dccea0c045e38631dec9c5cc6054c2cf21e782

                          SHA512

                          d80f259f5ef233c83b806ee9beddc05ace919246034dec006f2224bd90487b770bd48512e125fa123bb828615b0e5780c761352bedf3b72ab674fbe515dc6dca

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          b28fe690727a48f1436178a941bc1e31

                          SHA1

                          47d94e32100ffdb88645cbde848a518339b82420

                          SHA256

                          b040a981272d4548aa8ae401a061cd2b011ac970e6822072cc3f435543bb46bb

                          SHA512

                          9bf7cbbd0777a0a26027ae1d8a33348dae314b628299dd8cddf7199a960d58d2b05d2a196075581220846e29abfb97befd18c191b01478c9c89d01ab0be317b2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          7f042cdacaa63cfeeb4bfff030f39ea0

                          SHA1

                          4a34910ce7ee6a740bf56e158379a3dd10ef3746

                          SHA256

                          5c5fd8b3bbac7651144a682864b95821efef8e8cc039a6054e584d2f4e874740

                          SHA512

                          3aa2fb6162c7cabb95024cb3b472eab9ec7b1f964a48c4bcc1a57ddce3080b978ce0decd5e94f0e1360a69ebc72d08cfbb8f38a5fe8cf9b1f2f0329cbfc86ec7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          cc0232396332a32e9ee0f977649bf9c1

                          SHA1

                          c8025fc61e0dcffe96733fcc75f1f36fb41d4878

                          SHA256

                          5ab025fcc1b3092c4e4afa70b70000f8b9e8abee7f0a59e87978b890660e74d5

                          SHA512

                          48baff03cdf58fb36f4764371ac1e5e08fc01720e37c09e4ececc5de560bae7ead6d8a86bb26c69736012bfa6749d7b8b0535b22076f7a9f40184281a9ef2d36

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          4f02aef72014448153ab45073a70d403

                          SHA1

                          cad4b068b0859d885c8f8f091a9fc8d057a070d1

                          SHA256

                          39675d4d2f389152eae85ce051c59848777796d090e92260a9140dc411f8f541

                          SHA512

                          236474f1f76ce042dc84c9d2226b9171cd6160829cc792a4d5f89839ea6f6594e50f3d14a3eecc46366bcf48868565162382499f1f468686a2a3cc0cba22dde7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          106KB

                          MD5

                          65d8d43c1111fce717ace85d0364c53c

                          SHA1

                          e85df8292bbf5e510650e28e0fae485f2484c433

                          SHA256

                          c8f486de7c7173ae4eda929de9c697998e767095a90e5c4d2a1c339aba644125

                          SHA512

                          5da1e004f13620ef46fcc9c1b78d4ebb269a7bd08dffc6a6e65d0bd8e7a4defe154c5bea524b5bdc217a2c9c06eac2062f512d958f6a7c79322022d03af9f38c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          106KB

                          MD5

                          2cc191d244cfea9109e4e1a3b910c9ab

                          SHA1

                          06e609468640b3aeba12ff492932db61636c9d04

                          SHA256

                          ede35097cc696287c5b0eb4d642d0e59d337645c77fb7de818a52957706b8e05

                          SHA512

                          aa12021b789784bbeae1e2e0d232fe6448c574eb9355216cef248a09d3741573f20fe5f40de49e92debd4055b8c68875de7ed1c2274bf4f9724743e32e5d6cd7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          106KB

                          MD5

                          546dfc23f8ea5f583ac841e83a4362b7

                          SHA1

                          3cbdbb116b5e9bed086debf81d5f249dedd24d04

                          SHA256

                          8443618bdf791903f7eabf2c939783f366c92f4c38f982af11d82f02f9d2964b

                          SHA512

                          2e51e3a96029154d986846662bfb33cca94e22c88a586d21d2153fa3b9f35d16dea0d9705c3d0e9ff93849c0452425a6e824f0c3cc7bf573fa33737c9ed38946

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd